Single ASA with two ISPs active-active, failover help

Alkemyst71 — Fri, 22 Nov 2019 16:45:02 GMT

I am trying to figure out the best way to set this up on an ASA (9.6).

We want 10.0.1.0 to go out ISP1 unless it fails, then choose ISP2.

We want 10.0.2.0 to go out ISP2 unless it fails, then choose ISP1.

(This is for simplicity there are several networks)

Would this be the way (SLA for tracking not shown, but working):

object network obj_10.0.1.0_PRIMARY

subnet 10.0.1.0 255.255.255.0

description OFFICE_SUBNET

object network obj_10.0.2.0_PRIMARY

subnet 10.0.2.0 255.255.255.0

description VOICE_SUBNET

object network obj_10.0.1.0_SECONDARY

subnet 10.0.1.0 255.255.255.0

description OFFICE_SUBNET

object network obj_10.0.2.0_SECONDARY

subnet 10.0.2.0 255.255.255.0

description VOICE_SUBNET

route-map PRIORITY_ISP2 permit 20

match ip address priority-ISP2

set ip next-hop verify-availability [ISP2 IP] 1 track 1

set ip next-hop verify-availability [ISP1 IP] 2 track 2

access-list priority-ISP2 extended permit ip object obj_10.0.1.0 any

access-list priority-ISP2 extended permit ip object obj_10.0.2.0 any

route outside 0.0.0.0 0.0.0.0 [ISP1 IP] 1 track 1

route isp3-outside 0.0.0.0 0.0.0.0 [ISP2 IP] 60 track 2

object-group network ISP1Primary

network-object obj_10.0.1.0_Primary

network-object obj_10.0.2.0_Secondary

nat (any,ISP1) after-auto source dynamic ISP1Primary interface

object-group network ISP2Primary

network-object obj_10.0.2.0_Primary

network-object obj_10.0.1.0_Secondary

nat (any,ISP2) after-auto source dynamic ISP2Primary interface

Re: Single ASA with two ISPs active-active, failover help

balaji.bandi — Fri, 22 Nov 2019 23:09:32 GMT